6 ms·

Same. I feel so dumb now. After 15 years in this industry i finally figured out that ssl and tls are the same.

by oc1 1y ago

0xbadcafebee 1y ago
No no, they're not. They're names of specific protocols with specific capabilities and versions. "SSL 1.0" and "TLS 1.0" are very different. (see https://aws.amazon.com/compare/the-difference-between-ssl-and-tls/ https://aws.amazon.com/compare/the-difference-between-ssl-an...) The important bits: - "SSL" is a set of protocols so ridiculously old, busted and insecure that nobody should ever use them. It's like talking about Sanskrit; ancient and dead. - "TLS" is way better than "SSL", but still there are insecure versions. Any version before 1.2 is no longer supported due to security holes. - Technically an "ssl certificate" is neither "SSL" nor "TLS", it's really an "X.509 Certificate with Extended Key Usage: Server Authentication". But that doesn't roll off the tongue. You could use a cert from 1996 in a modern TLS server; the problem would be its expiration date, and the hash/signature functions used back then are deprecated. (some servers still support insecure methods to support older clients, which is bad)
- MOARDONGZPLZ 1y ago
  Right, but they accomplish the same thing and people move monotonically from SSL to TLS. It’s not like choosing between React and Angular, but like choosing between React version 5 and React version 10 for a new project. SSL and TLS are the same in all meaningful respects from this perspective.
  - 0xbadcafebee 1y ago
    Hotdogs and hamburgers are the same in all meaningful respects.
    - MOARDONGZPLZ 1y ago
      They are not. But a Chicago dog is meaningfully the same as a New York Dog (just with some more vegetables).
      - 0xbadcafebee 1y ago
        A Chicago dog is literally a hamburger with a different surface area. Same obscure ground beef, same vegetables, same bread. Just different dimensions. Who cares about the details, right?
        MOARDONGZPLZ 1y ago
        Very weird assertion, and happy to be dragged into a sub-post wasteland with you. <3
        wombatpm 1y ago
        I don’t know of anyone who puts celery salt on a hamburger.
        i80and 1y ago
        I think it would probably be good, though?
  - ozim 1y ago
    Well nope SSL and TLS is more like Angular and AngularJS. No one should use SSL or AngularJS in 2025 unless they have to maintain some legacy stuff for important reasons.
- creatonez 1y ago
  The point is more that SSL 3.0 and TLS 1.0 were nearly identical. That is, the breaks in similarity were at SSL 2.0 -> SSL 3.0 (and TLS 1.2 -> TLS 1.3, to a lesser extent), as opposed to the common misconception that TLS 1.0 is what changed everything. But yes, it's all a bit irrelevant now that anything below TLS 1.2 is sketchy to use.
- GoblinSlayer 1y ago
  It's a new word in version churn: rename the whole thing on every commit.
JdeBP 1y ago
Back closer to the time, there were some people around who insisted that SSL specifically meant the old versions and it was all TLS now. I recall a couple of occasions where people were talking about UCSPI-SSL and someone stepped in to explain that We Don't Do SSL Now. As the headlined article says, that contrived distinction seems silly with the hindsight of decades. The nomenclature was complicated in people's minds by SMTP. Because there was SMTP over a largely transparent encrypted connection, and SMTP where it started unencrypted and negotiated a switch, as well as plain old cleartext. It didn't help that RFC 2487 explained that STARTTLS negotiated "TLS more commonly known as SSL". RFC 8314 explains some of the historical mess that SMTP got into with two types of SMTP (relay and submission) and three types of transport. And the "S" for "submission" could be confused with the "S"s in both "SSL" and "TLS". It's not just TLAs that are ambiguous, indeed. There was confusion over "SMTPS" and "SSMTP", not helped at all by the people who named programs things like "sSMTP". I'm still calling it SSL in 2025. (-: And so is Erwin Hoffmann. * https://www.fehcom.de/ipnet/sslserver.html https://www.fehcom.de/ipnet/sslserver.html * https://manpages.debian.org/unstable/ssmtp/ssmtp.8.en.html https://manpages.debian.org/unstable/ssmtp/ssmtp.8.en.html
- nkapias 1y ago
  'It didn't help that RFC 2487 explained that STARTTLS negotiated "TLS more commonly known as SSL"' > Good catch, it misled me for years !
commandlinefan 1y ago
In reality, you may never have actually used SSL, and if you're old enough to have, you haven't used it in decades (I hope).

Same. I feel so dumb now. After 15 years in this industry i finally figured out that ssl and tls are the same.

by oc1 1y ago

Same. I feel so dumb now. After 15 years in this industry i finally figured out that ssl and tls are the same.

No no, they're not. They're names of specific protocols with specific capabilities and versions. "SSL 1.0" and "TLS 1.0" are very different. (see https://aws.amazon.com/compare/the-difference-between-ssl-and-tls/ https://aws.amazon.com/compare/the-difference-between-ssl-an...) The important bits: - "SSL" is a set of protocols so ridiculously old, busted and insecure that nobody should ever use them. It's like talking about Sanskrit; ancient and dead. - "TLS" is way better than "SSL", but still there are insecure versions. Any version before 1.2 is no longer supported due to security holes. - Technically an "ssl certificate" is neither "SSL" nor "TLS", it's really an "X.509 Certificate with Extended Key Usage: Server Authentication". But that doesn't roll off the tongue. You could use a cert from 1996 in a modern TLS server; the problem would be its expiration date, and the hash/signature functions used back then are deprecated. (some servers still support insecure methods to support older clients, which is bad)

MOARDONGZPLZ 1y ago
Right, but they accomplish the same thing and people move monotonically from SSL to TLS. It’s not like choosing between React and Angular, but like choosing between React version 5 and React version 10 for a new project. SSL and TLS are the same in all meaningful respects from this perspective.
- 0xbadcafebee 1y ago
  Hotdogs and hamburgers are the same in all meaningful respects.
  - MOARDONGZPLZ 1y ago
    They are not. But a Chicago dog is meaningfully the same as a New York Dog (just with some more vegetables).
    - 0xbadcafebee 1y ago
      A Chicago dog is literally a hamburger with a different surface area. Same obscure ground beef, same vegetables, same bread. Just different dimensions. Who cares about the details, right?
      - MOARDONGZPLZ 1y ago
        Very weird assertion, and happy to be dragged into a sub-post wasteland with you. <3
      - wombatpm 1y ago
        I don’t know of anyone who puts celery salt on a hamburger.
        i80and 1y ago
        I think it would probably be good, though?
- ozim 1y ago
  Well nope SSL and TLS is more like Angular and AngularJS. No one should use SSL or AngularJS in 2025 unless they have to maintain some legacy stuff for important reasons.
creatonez 1y ago
The point is more that SSL 3.0 and TLS 1.0 were nearly identical. That is, the breaks in similarity were at SSL 2.0 -> SSL 3.0 (and TLS 1.2 -> TLS 1.3, to a lesser extent), as opposed to the common misconception that TLS 1.0 is what changed everything. But yes, it's all a bit irrelevant now that anything below TLS 1.2 is sketchy to use.
GoblinSlayer 1y ago
It's a new word in version churn: rename the whole thing on every commit.

JdeBP 1y ago

Back closer to the time, there were some people around who insisted that SSL specifically meant the old versions and it was all TLS now. I recall a couple of occasions where people were talking about UCSPI-SSL and someone stepped in to explain that We Don't Do SSL Now. As the headlined article says, that contrived distinction seems silly with the hindsight of decades. The nomenclature was complicated in people's minds by SMTP. Because there was SMTP over a largely transparent encrypted connection, and SMTP where it started unencrypted and negotiated a switch, as well as plain old cleartext. It didn't help that RFC 2487 explained that STARTTLS negotiated "TLS more commonly known as SSL". RFC 8314 explains some of the historical mess that SMTP got into with two types of SMTP (relay and submission) and three types of transport. And the "S" for "submission" could be confused with the "S"s in both "SSL" and "TLS". It's not just TLAs that are ambiguous, indeed. There was confusion over "SMTPS" and "SSMTP", not helped at all by the people who named programs things like "sSMTP". I'm still calling it SSL in 2025. (-: And so is Erwin Hoffmann. * https://www.fehcom.de/ipnet/sslserver.html https://www.fehcom.de/ipnet/sslserver.html * https://manpages.debian.org/unstable/ssmtp/ssmtp.8.en.html https://manpages.debian.org/unstable/ssmtp/ssmtp.8.en.html

nkapias 1y ago
'It didn't help that RFC 2487 explained that STARTTLS negotiated "TLS more commonly known as SSL"' > Good catch, it misled me for years !

commandlinefan 1y ago

In reality, you may never have actually used SSL, and if you're old enough to have, you haven't used it in decades (I hope).